PHP Vulnerability “PHP2Shell”: Payrexx Is Protected

Incident Report for Payrexx

Resolved

On 20 and 21 October 2026, two critical vulnerabilities in PHP were disclosed (CVE-2026-109618 / CVE-2026-109619). Many websites and online shops run on PHP, including parts of Payrexx.

On 21 October 2026, we applied a protective measure even before the official update was available, and rolled out the fixed PHP version across the entire platform the same evening. Payrexx services ran without interruption. We have found no indication that the vulnerabilities were exploited on our systems.

No action is required for your Payrexx account. If you run your own online shop on PHP, e.g. WooCommerce, Magento or Shopware, please ask your hosting provider or web agency to confirm that PHP has been updated.

Posted Oct 22, 2026 - 10:06 UTC

This incident affected: Payment Platform (Servers).